Re: [TLS] TLS 1.2 clarification requested

[Yoav Nir <[e-mail]>]

On Oct 1, 2013, at 9:58 PM, "Kain, Michael T" <[e-mail]<mailto:[e-mail]>> wrote:

I’m trying to understand the TLS 1.2 restrictions and signature algorithms and how they interact.  Is there a relation between the signature algorithm that is negotiated between client and server and the algorithm which signed the server certificate?

Yes. According to sections 2.2 and 2.4 or RFC 4492, the server certificate for ECDHE_ECDSA and ECDHE_RSA MUST have ECDSA and RSA public keys respectively, and also MUST be signed by ECDSA and RSA respectively. I'm not sure why that last restriction is needed, but it's there. For non-EC ciphersuites, there is no restriction, but you still need to negotiate an algorithm that works with the public key.

Does that affect the hash algorithm of TLS 1.2 – or is that always SHA256?

The hash used in the algorithm (for example: to calculate the Finished message) is ciphersuite-specific, but all current ciphersuites that anybody uses specify SHA-256.

For example, if I’ve got a server configured with a server certificate signed with SHA256, can it still establish a connection using the TLS_RSA_WITH_AES_256_CBC_SHA?

Yes, and then you'll have
 - a certificate signed with RSA-with-SHA256
 - records MAC'd with HMAC-SHA1
 - SHA256 in the Finished calculation

Does the signature algorithm for a certificate affect which Ciphersuites can be negotiated and used?

Only because the ECC RFC says so. It is obviously restricted by the public key. There's also the DH and ECDH key exchanges (non-ephemeral) that have their own restrictions, but I'm not aware of anyone who uses them.

Yoav